Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
63b53532b4267aacb2fab99033d2ea60.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
63b53532b4267aacb2fab99033d2ea60.exe
Resource
win10v2004-20231222-en
General
-
Target
63b53532b4267aacb2fab99033d2ea60.exe
-
Size
720KB
-
MD5
63b53532b4267aacb2fab99033d2ea60
-
SHA1
f4927de1d1c3b0f8f0b41e0dd64cadc62df32023
-
SHA256
714f11ed7d83f9cd2067675f873f43e76781fa23982832998d9813738e2e26ab
-
SHA512
b713f3cc89cf223b149b79d47b9b51e8dd0f23558144718b07abdc5ae5c38ad61acb7bb02df8ded04af4659849961dad03df99e598ff27a06f514761045d3538
-
SSDEEP
12288:KhISonTeU3yl7oZgmt3HsnCeZX6Wnb7+NtoTKGZruC:U01OWsnR3b7atS1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 63b53532b4267aacb2fab99033d2ea60.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1432 set thread context of 4860 1432 63b53532b4267aacb2fab99033d2ea60.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2000 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1432 63b53532b4267aacb2fab99033d2ea60.exe 1432 63b53532b4267aacb2fab99033d2ea60.exe 2924 powershell.exe 2924 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1432 63b53532b4267aacb2fab99033d2ea60.exe Token: SeDebugPrivilege 2924 powershell.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2924 1432 63b53532b4267aacb2fab99033d2ea60.exe 95 PID 1432 wrote to memory of 2924 1432 63b53532b4267aacb2fab99033d2ea60.exe 95 PID 1432 wrote to memory of 2000 1432 63b53532b4267aacb2fab99033d2ea60.exe 96 PID 1432 wrote to memory of 2000 1432 63b53532b4267aacb2fab99033d2ea60.exe 96 PID 1432 wrote to memory of 4860 1432 63b53532b4267aacb2fab99033d2ea60.exe 99 PID 1432 wrote to memory of 4860 1432 63b53532b4267aacb2fab99033d2ea60.exe 99 PID 1432 wrote to memory of 4860 1432 63b53532b4267aacb2fab99033d2ea60.exe 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\63b53532b4267aacb2fab99033d2ea60.exe"C:\Users\Admin\AppData\Local\Temp\63b53532b4267aacb2fab99033d2ea60.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bgGYPWp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bgGYPWp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA4FA.tmp"2⤵
- Creates scheduled task(s)
PID:2000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵PID:4860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5064e01c755e1252a5ee45dfa973df78a
SHA1588458aa6bcae7deaa22c71a8ce68758d56b743d
SHA2569f4ebc9dc24c3a975d7b46c1db05e4e7fdaf119eb1fe836705e928ac9cd0e2c8
SHA5120c67e5a9159b83260252450be5344a02fbb9928df154f51cd2ab068084cf8bb1b4e17568576d416e5ad86485adbfc19b49b027750645923aea63d9be0c01f8b2